ActiveRecord SQL injection and secret_token.rb

Michael Orazi morazi at redhat.com
Tue Jan 8 19:49:03 UTC 2013



----- Original Message -----
> On Fri, Jan 04, 2013 at 09:04:52AM +0100, Vít Ondruch wrote:
> ...
> > However, what is more important is, that since your application
> > secret token
> > is not that secret, i.e. it is published on github [2], cookies of
> > Aeolus
> > could be faked [3]. Katello seems to do better in this area [4]
> > (although it
> > was just quick look into code, not security audit :)). Please
> > consider
> > narrowing this situation.
> > 
> ...
> > [2]
> > https://github.com/aeolusproject/conductor/blob/master/src/config/initializers/secret_token.rb#L23
> > [3]
> > http://biggestfool.tumblr.com/post/24049554541/reminder-secret-token-rb-is-named-so-for-a-reason
> > [4]
> > https://github.com/Katello/katello/blob/master/src/config/initializers/secret_token.rb
> 
> I suggest that Conductor should deal with the token the exactly same
> way Katello
> does. See no problem in their approach.
> 
> Objections?
> 
> --
> Martin Povolny <mpovolny at redhat.com>
> tel. +420777714458
> 

+1 -- if you take this on, please include a patch to 'do the right thing' in configure.

m



More information about the aeolus-devel mailing list